medusajs/medusa · warning · MedusaError

NOT_ALLOWED

NOT_ALLOWED

Error message

You must provide the region_id to list payment providers

What it means

Thrown by GET /store/payment-providers when the required region_id filter is missing. Payment providers are scoped per region in Medusa, so listing them requires knowing which region to query. The route validates req.filterableFields.region_id and throws NOT_ALLOWED when absent.

Source

Thrown at packages/medusa/src/api/store/payment-providers/route.ts:18

import {
  AuthenticatedMedusaRequest,
  MedusaResponse,
} from "@medusajs/framework/http"
import {
  ContainerRegistrationKeys,
  MedusaError,
  remoteQueryObjectFromString,
} from "@medusajs/framework/utils"
import { HttpTypes } from "@medusajs/framework/types"

// TODO: Add more fields to provider, such as default name and maybe logo.
export const GET = async (
  req: AuthenticatedMedusaRequest<HttpTypes.StorePaymentProviderFilters>,
  res: MedusaResponse<HttpTypes.StorePaymentProviderListResponse>
) => {
  if (!req.filterableFields.region_id) {
    throw new MedusaError(
      MedusaError.Types.NOT_ALLOWED,
      "You must provide the region_id to list payment providers"
    )
  }

  const remoteQuery = req.scope.resolve(ContainerRegistrationKeys.REMOTE_QUERY)
  const queryObject = remoteQueryObjectFromString({
    entryPoint: "region_payment_provider",
    variables: {
      filters: {
        region_id: req.filterableFields.region_id,
      },
      ...req.queryConfig.pagination,
    },
    fields: req.queryConfig.fields.map((f) => `payment_provider.${f}`),
  })

  const { rows: regionPaymentProvidersRelation, metadata } = await remoteQuery(

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Pass region_id as a query parameter: GET /store/payment-providers?region_id=re_...
2. Derive the region_id from the current cart (cart.region_id) before calling the endpoint
3. Ensure your region bootstrap logic (e.g. region cookie resolution) has run before fetching providers

Example fix

// before
const providers = await sdk.store.paymentProvider.list({}) // 400-ish: region_id required

// after
const providers = await sdk.store.paymentProvider.list({ region_id: cart.region_id })

if (!regionId) throw new Error('Select a region first')
const providers = await sdk.store.paymentProvider.list({ region_id: regionId })

const hasRegionId = (cart: Cart | null): cart is Cart & { region_id: string } =>
  !!cart?.region_id

When it happens

Trigger: Calling GET /store/payment-providers without ?region_id=... in the query string.

Common situations: Frontend fetches payment providers before a cart/region is selected; region_id stored in local state is null/undefined and serialized as nothing; forgetting the query param after upgrading storefront code.

Related errors

• invalid_data
• Country with code ${shippingAddress.country_code} is not wit
• Region with id: ${req.params.id} was not found
• Requested sales channel is not part of the publishable key
• Missing required pricing context to calculate prices - regio

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/4098da967983f084. Report an issue: GitHub.